Threat Hunting and Detection CTIA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat hunting team wants to detect a newly discovered malware family that uses a unique domain generation algorithm (DGA) and specific HTTP user-agent strings. The team has access to DNS logs, proxy logs, and endpoint telemetry. Which methodology would be most effective for this specific detection goal?

   • AAnalytics-driven hunting using machine learning to identify anomalous DNS patterns
   • BManual hunting by reviewing every DNS query and HTTP request from the last month
   • CIOC-based hunting by searching for the DGA domains and user-agent strings across logs
   • DHypothesis-driven hunting that assumes the malware is present and then collects all network traffic for analysis
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common use case for machine-assisted threat hunting?

   • AReplacing human analysts entirely
   • BGenerating random alerts to test the SOC
   • CEliminating the need for threat intelligence
   • DAutomating repetitive data queries and correlating large datasets
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat hunter is evaluating tools to support a new hunting program. The team has a mix of Windows and Linux endpoints, and they want to search across both endpoint and network data. They also need to support both manual and automated hunting. Which tool category would be MOST suitable?

   • AA SIEM platform with advanced query capabilities and integration with endpoint and network data sources.
   • BA standalone network packet capture tool like Wireshark.
   • CA single-endpoint EDR tool that only supports Windows.
   • DA vulnerability scanner to identify missing patches.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which type of tool is specifically designed to query and analyze large volumes of security data for hunting?

   • APatch management tool
   • BVulnerability scanner
   • CNetwork firewall
   • DSecurity Information and Event Management (SIEM) platform
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A threat hunting team identifies a compromised host that is beaconing to a known C2 server. The incident response team is busy with another critical incident. The hunting team has the authority to contain the host. What is the best course of action?

   • AAdd the C2 domain to the DNS blocklist and monitor the host
   • BWait for the IR team to finish the other incident before taking action
   • CDisconnect the host from the network and continue hunting for other compromised hosts
   • DIsolate the host immediately and then document the finding for IR follow-up
   Reveal Solution Discussion Select an answer first